patch 9.1.0739: [security]: use-after-free in ex_getln.c
Problem: [security]: use-after-free in ex_getln.c
Solution: free pointer p a bit later (John Marriott)
closes: #15712
Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/ex_getln.c b/src/ex_getln.c
index 1b3a699..b4c7941 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -3330,7 +3330,6 @@
// there, thus copy up to the NUL and add a NUL.
mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen);
ccline.cmdbuff[ccline.cmdlen] = NUL;
- vim_free(p);
if (ccline.xpc != NULL
&& ccline.xpc->xp_pattern != NULL
@@ -3345,6 +3344,8 @@
ccline.xpc->xp_pattern = ccline.cmdbuff + i;
}
+ vim_free(p);
+
return OK;
}